1

TAPASIST-2001-34069

Trusted and QoS-Aware Provision of Application Services

TAPASPeriodic Progress Report – PPR2

Report Version: Deliverable PPR2

Report Delivery Date: April 2004

Classification: Public Circulation

Contract Start Date: 1 April 2002 Duration: 36m

Project Co-ordinator: Newcastle University

Partners: Adesso, Dortmund – Germany; University College London – UK; University ofBologna – Italy; University of Cambridge – UK

Project funded by the European Communityunder the “Information Society Technology”Programme (1998-2002)

1

1. Executive Summary

In the TAPAS project, we are particularly interested in developing solutions to the problemfaced Application Service Providers (ASPs) when called upon to host distributed applicationsthat make use of a wide variety of Internet services provided by different organisations. Thisnaturally leads to the ASP acting as an intermediary for interactions for information sharing thatcross organisational boundaries. However, despite the requirement to share information andservices, autonomy and privacy requirements of organisations must not be compromised.Organisation will therefore require their interactions with other organisations to be strictlycontrolled and policed. Furthermore, an ASP should be capable of meeting specific quality ofservice (QoS) requirements of hosted applications.

This creates major challenges. Contractual relationships between multiple organisations forinformation access, sharing and QoS will need to be governed by service level agreements(SLAs), which will need to be defined and agreed between the organisations and then enforcedand monitored by the ASP. Unfortunately, ASPs currently lack tools and techniques foroffering hosting facilities for such distributed applications: the reason why TAPAS project hasbeen created. First year work has been concerned with developing an overall framework for thedevelopment of software tools and techniques for hosting advanced distributed applications:deliverable reports: D1 (requirements), D2 (SLA specification), D5 (TAPAS architecture,describing trust management and regulation of inter-organisation interactions), D5 supplement(overview of TAPAS architecture), and D7 (TAPAS middleware platform: QoS enabledapplication servers).

Second year work has been concerned with design and implementation of various subsystemsin accordance with the above deliverables. SLA specification and analysis tools have beendeveloped (deliverable D3), QoS enabled multicast communication, trusted coordination, andQoS monitoring services have been developed (deliverables D8, D9 and D10 respectively);deliverable report D13 describes how these services will be used in the TAPAS platform forhosting a distributed auction application.

2

2. Project Rationale and Exploitation Plan

2.1. Rationale

Organisations, particularly small and medium scale enterprises (SMEs), are increasingly findingit difficult to develop, maintain and manage their IT applications largely due to difficulties inretaining and attracting trained IT staff. Application Service Providers (ASPs) hold the promiseof providing an attractive solution by making available application hosting facilities on remotelymanaged servers. However, to work effectively, ASPs must guarantee security, provideresilience and service level agreements (SLAs) over commonly available infrastructures.Furthermore, ASPs need to ensure that hosted applications are capable of accessing a widevariety of services irrespective of the platform or the organisation through which they areprovided. An ASP typically uses middleware and component technologies for deploying,hosting and managing applications of an organization from a centrally managed facility.However, as organisations become global and distributed, such centrally managed hostingsolutions will need to be replaced by multi-site, distributed hosting solutions.

The goal of TAPAS is to develop multi-site, distributed hosting solutions. We argue that manyresearch problems in enterprise distributed computing will need to be solved to achieve the goalof TAPAS. An ASP will increasingly be called upon to host distributed applications that makeuse of a wide variety of Internet services provided by different organisations. This naturallyleads to the ASP acting as an intermediary for interactions for information sharing that crossorganisational boundaries. However, despite the requirement to share information and services,autonomy and privacy requirements of organisations must not be compromised. Organisationwill therefore require their interactions with other organisations to be strictly controlled andpoliced. This creates two major challenges. Firstly, contractual relationships between multipleorganisations for information access, sharing and quality of service (QoS) will need to begoverned by SLAs, which will need to be defined and agreed between the organisations andthen enforced and monitored by the ASP. Secondly, the ASP will have to establish appropriatetrust relationships with the organisations and implement corresponding security policies beforeorganisations will permit the ASP to act as an intermediary for inter-organisational serviceinvocations. Unfortunately, middleware services for inter-organisational interactions as outlinedabove do not yet exist; indeed, development of such services is very much a research problem.Thus ASPs currently lack tools and techniques for offering hosting facilities for advancedInternet based applications.

2.2. Exploitation Plan

Updated exploitation plans of each partner are provided here.

Newcastle University: The Distributed Systems Group has a strong record of working withindustries. In conjunction with Nortel (Harlow research lab), we contributed to the developmentof the workflow standard by making a submission to the OMG based on our workflowtechnology (Nortel and University of Newcastle upon Tyne, “Workflow Management FacilitySpecification”, Revised submission, OMG document bom/98-03-01). We collaborated withIBM, IONA Technologies and others in making an OMG submission “Additional structuring

3

mechanisms for the OTS”; this submission has now been adopted as the OMG standard forextended transactions, and will be part of future release of J2EE middleware. Results fromTAPAS will be used in existing and future research projects on middleware related distributedcomputing.

HP Arjuna Labs was founded as Arjuna Solutions Ltd., in October 1998 by members of theDistributed Systems Group at the University of Newcastle-upon-Tyne. Arjuna’s foundersparticipated in the creation of an early example of a distributed object transaction system (in1989), and the first C++ and Java implementations of the Object Transaction Service (in 1997).Arjuna Solutions Ltd. was acquired by Bluestone Software Technologies in July 2000 and sixmonths later, Hewlett-Packard acquired Bluestone resulting in Arjuna being renamed HPArjuna Labs. The Labs 100% Java implementation of the Java Transaction Service (JTS) fromSun Microsystems, is being sold as part of the resilient pack of the HP-Application Serveralong with other Java based distributed technology including messaging technology and webservices. The recent merger of Compaq with HP led to a major restructuring within HP, withHP pulling out of the middleware business. HP Arjuna lab is now operating as ArjunaTechnologies Ltd (ATL) and is based in the University. Close collaboration with the DistributedSystems Group is being maintained ATL has a seat on the Industry Advisory Board.

Newcastle and ATL are taking part in EU Project IST-2001-37126: “ADAPT (MiddlewareTechnologies for Adaptive and Composable Distributed Components” where there is specificcollaboration of trust and security. Newcastle is also taking part in two UK funded projects onvirtual organisations that complement the work being done in TAPAS. In particular, in theGOLD project, Web services and component middleware will be used as the enablingtechnology to develop a set of methods and tools for dealing with trust, security, lifecycle andinformation management in highly dynamic Virtual Organisations (VOs) the chemical industry.

Adesso AG:Adesso AG is a full service provider for the design, development and operation ofe-business applications. The development paradigm applied is that of component-basedsoftware development. This paradigm and the application domain of e-business applicationsperfectly match because most e-business applications encompass various COTS components.This does not only pose some extra challenges with respect to system integration, releasemanagement and test of e-business applications, but it is also hindering the business modelASP for e-business applications. Due to the heterogeneity of e-business application standardASP service level agreements usually cannot be applied. Instead it is necessary to relate servicelevel agreements to components of an e-business application individually. This may, forexample, mean to define service levels agreements as the following:

• The portal site will be accessible for 98% of the time.

• Access to the e-controlling component is ensured for 90% of the time.

• The minimal recovery time for the access to individual customer data is 20 minutes;

the recovery time for profile data is 60 minutes.

This example shows, that different types of functionality ask for detailed agreements. Thus,fine-grained service level agreements help to provide the services needed at affordable costs. Of

4

course, it is possible to offer only more coarse-grained service levels, but this usually leads tocost explosions which are not acceptable for customers. With the possibility to define andimplement fine-grained service level agreements developed by TAPAS, Adesso can foster itscore business in several ways:

1. It is possible to argue for component-based development of e-business applications, becausethis is a prerequisite for fine-grained service level agreements.

2. The range of software systems which can be integrated into e-business applications, whichare ASP-operated is extended. For the time being, systems whose low robustness endangers theavailability of the overall e-business application cannot be integrated. If it was possible to agreefor lower services or such a component, it would be possible to integrate despite its robustness.

3. The ASP services of Adesso will be much more attractive, if fine-grained agreements arepossible. In contrast to standard offerings, the ASP levels can be precisely adapted to customerrequirements.

While the first and second way to foster the Adesso business cannot be calculated in concretenumbers, the third way is supposed to allow an extra 20% growth in ASP business (after beingable to define and implement fine-grained service level agreements).

In addition to these perspectives the results of the second TAPAS year have produced newaspects that adesso will exploit.

Firstly, the trust management scenario is now broken down into supervision and controllinginter-organisational relationships to ensure the fairness of business processes as seen byTAPAS. This is based on the ability to monitor the SLA-fulfilment from outside the ASP,typically by a trusted third party using dedicated TAPAS components to gather and evaluatedata and process information. This setup seems to be very promising for certain types ofbusiness situations. For example, it is a common problem for insurance companies to assurethat their brokers have a ensured quality when accessing the insurance's backend systems. Itshould be noted that brokers are quite often not employees of an insurance, which leads toobvious trust- and QoS-problems, because brokers have to pay directly or indirectly for usingthe infrastructure of insurance companies. The same type of problem arises in other sectors ofindustries where many external business users access a company's service. adesso has a strongknowledge in the insurance sector and plans to offer such QoS-related services to it's insuranceclients.

Furthermore it can be observed, that the TAPAS tools and techniques will allow to predict theutilization figures for the existing infrastructure. This will of course help to optimise theresource planning, i.e. it will be safe to run two completely separated applications in the sameenvironment. Due to increased resource utilization costs can be reduced, which shall lead tomore competitive offers.

The TAPAS middleware implementation seamlessly integrates with the standardized J2EEenvironment, which will allow an ASP or application developer to even integrate foreign, non-TAPAS components and services with controlled SLA-fulfilment. This can be achieved bydeveloping a simple interface component in J2EE technology, which is run inside the ASP on aTAPAS-enhanced application server. The requested SLA will then be supervised for this

5

dedicated component. This approach might not allow to reconfigure a weak server to fulfil therequirements but will at least enable ASPs to supervise services they pay for. Hence integrationof services such as payment, rating etc. will be easier to integrate and therefore building newservices will be less costly.

A promising approach of the TAPAS middleware implementation lies in the decision thatapplications are unaware of the TAPAS middleware services. The TAPAS extensions for theapplication server make use of the interceptor concept and are therefore completely transparentto the application. This offers the possibility to re-use existing J2EE-applications with aTAPAS-enhanced application server with very little or even none overhead. Hence it is simple todemonstrate clients the costs and advantages of the TAPAS-enhanced application server, whichwill result in extended offers for existing ASP clients.

Besides the comparability of two environments and the beneficial effect of proving the QoS-characteristics of an existing application, there is another benefit from adesso's point of view. Itis good industrial practise to run load and stress tests for an application to ensure it's quality.By using a TAPAS-enhanced application server software developers will be able to retrievedetailed and accurate profiling information about the critical spots of their J2EE applications.Hence it will be much easier and therefore cheaper to identify and fix performance bottlenecksand inefficient coding.

This aspect leads to the business opportunity of taking over existing applications into an ASPsolution, usually as part of an outsourcing project. Before signing a contract the ASP will beable to run tests and to find out non-obvious characteristics.

Adesso plans to exploit these aspects by dedicated offerings to existing clients. Furthermoreadesso plans to extend it's portfolio to related services.

University of Bologna: The research group at the Department of Computer Science of theUniversity of Bologna maintains close cooperation with national and international industries,including Microsoft (Cambridge Research Laboratory) and Sun Microsystems, and nationalresearch institutes, the "Fondazione Marconi" and the ENEA (the Italian bureau for newtechnologies applied to the energy and environment), in the form of joint investigations undercontracts and grant programmes.

In addition, this research group is involved in the following two projects, recently approved bytheir relative funding bodies:

(i) "Information Society - Architectures and Protocols for Replicated Web Services", funded bythe Italian Ministry of the Education, University, and Research (MIUR), and

(ii) "Design, development, and evaluation of an infrastructure for supporting mobile, multimodalaccess to Web services", funded by the Emilia-Romagna County Council.

Both these projects, which are carried out in collaboration with a number of Italian Universitiesand companies, address issues of design of QoS-aware middleware services and platforms.Specifically, the former project deals with issues of service replication in geographicallyclustered Web Services, and assumes that the geographical cluster of servers that support thoseServices can cross organizational boundaries. The latter, instead, addresses issues of Web

6

access ubiquity, and investigates the design of middleware solutions that enable the WebService designer to meet the so-called Always Best Connected (ABC) requirement in amultimodal and mobile environment.

Owing to their very nature and relative scope, both these projects are planning to use ofsolutions and technologies which are being developed as part of the TAPAS project; thus, boththese projects can notably contribute to the dissemination and use of those solutions andtechnologies.

University College London: UCL relies to a considerable extent on direct industrial fundingand consulting. The knowledge required to be able to provide high-quality consulting services isoften produced in projects such as TAPAS. UCL therefore hopes to exploit the results of theTAPAS in the following ways:

• Technology transfer initiatives towards the industry.

• Provision of consulting services to external companies (including education and

training).

• Dissemination (consisting essentially of publications and courses).

The Software Systems Engineering Group of UCL is well positioned for this exploitation. Ithas ongoing research collaborations with a number of industrial partners, including BritishTelecom, Hewlett Packard Labs, IBM Hursley Park, Kodak, Microsoft Research, UK NationalAir Traffic Services, Philips, Searchspace, Telelogic, Toshiba Corporation, UBS Warburg,Unipower Solutions and the Zuehlke Technology Group. The TAPAS project partners hope touse these good collaborations as a route for exploiting the knowledge produced in TAPAS.Zuehlke Technology Group has a seat on the Industry Advisory Board.

University of Cambridge: Cambridge University has a plethora of industrial collaborators,and will seek to exploit any and all of its research when appropriate. In this project, links withMicrosoft Research may prove extremely valuable, as they have a research laboratory inCambridge working in collaboration with the University. As well as this, the Hewlett Packardresearch lab may also be potential paths to exploitation, given long term relationships with them.Finally, we will be able to use the output of TAPAS within the academic community itselfdirectly to support more performant application services for teaching and research.

The Principal Investigator at Cambridge University is active in the IETF, in the RMT workinggroup (5 RFCs last year), as well as more generally in Transport Area working group. As wellas this, we co-chair the Grid High Performance Network research group of the GGF. In thesetwo organisations, we have a direct path to taking group communications protocols to theInternet Standards world as well as to the scientific user community, and we can help withdissemination of results on technologies and techniques for implementing Service LevelAgreement.

Cambridge also has another EU project and several PhD students working on a variety oftechniques to support Trust in Distributed Systems. As well as working with the partners in theother project, we have been and will continue to publish in academic outlets.

7

As well as Microsoft Research, who fund several PhDs working in distributed computing in thelab, we also now have a strong working relationship with Intel Research Cambridge (started inthe same building as the Computer Lab, after the TAPAS Project was initiated). Their interestsin performance monitoring overlap with ours.

8

3. Project Objectives

3.1. Overall ObjectivesThe overall objective of the TAPAS project is to develop novel methods, tools, algorithms andprotocols that support the construction and provisioning of Internet application services. Theproject will achieve the overall objective by developing QoS enabled middleware servicescapable of meeting Service Level Agreements (SLAs) between application services and willenhance component based middleware technologies such that components can be deployed andinteract across organisational boundaries. The project will develop notations for expressingSLAs to enable specification of QoS, such as the availability as well as trust relationships. SLAtrust specifications will be used for deriving service invocation primitives enriched withauthentication, non-repudiation mechanisms, with or without the involvement of trusted thirdparties.

3.2. Specific objectives for the reporting periodFirst year work has been concerned with developing an overall framework for the developmentof software tools and techniques for hosting advanced distributed applications: deliverablereports: D1 (requirements), D2 (SLA specification), D5 (TAPAS architecture, describing trustmanagement and regulation of inter-organisation interactions), D5 supplement (overview ofTAPAS architecture), and D7 (TAPAS middleware platform: QoS enabled application servers).

Second year work has been concerned with design and implementation of various subsystemsin accordance with the above deliverables. SLA specification and analysis tools have beendeveloped (deliverable D3), QoS enabled multicast communication, trusted coordination, andQoS monitoring services have been developed (deliverables D8, D9 and D10 respectively);deliverable report D13 describes how these services will be used in the TAPAS platform forhosting a distributed auction application.

4. Achievements and project status

4.1. SummaryIn the TAPAS project, we are particularly interested in developing solutions to the problemfaced by Application Service Providers (ASPs) when called upon to host distributedapplications that make use of a wide variety of Internet services provided by differentorganisations. This naturally leads to the ASP acting as an intermediary for interactions forinformation sharing that cross organisational boundaries. Essentially this means that an ASPshould be capable of hosting Virtual Enterprises1 (VEs): meaning, it should be capable of

1 A Virtual Enterprise comprises n independently existing and possibly mutually suspicious enterpriseseach of which wishes to establish a close business relationship for an agreed period of time withoutloosing its independence (autonomy).

9

providing facilities for forming and managing VEs. The main problem in VE management ishow enterprises can regulate access to their resources by other enterprises in a way to ensurethat their individual policies for information sharing are honoured. Regulating access toresources by other enterprises is made difficult, since each potentially accessible enterprisemight not unguardedly trust the others. Enterprises within a VE will therefore require theirinteractions with one another other to be strictly controlled and policed. And in this context,there will be a clear need among all parties to embark upon their business relationshipsunderpinned by guarded trust management procedures. How can this be achieved?

Further, we note that in the near future ASP will require a distributed execution environmentwith a number of core services capable of meeting specific non-functional requirements of faulttolerance, availability, security, and timeliness; we will refer to these as QoS enabled services.State-of-the-art application services are developed using component-based technologies, such asthose provided by the Java 2 Enterprise Edition (J2EE), Microsoft’s .NET or the ObjectManagement Group’s CORBA Component Model. These technologies support thespecification of functional component interfaces. They, however, do not adequately support thedefinition of the non-functional characteristics of component execution.

The first year work has been concerned with the design of the overall TAPAS architecture. Thefigure shows the main features of the TAPAS architecture. If we ignore the threeshaded/patterned entities (these are TAPAS specific components), then we have a fairly‘standard’ application hosting environment: an application server constructed using componentmiddleware (e.g., J2EE). It is the inclusion of the shaded/patterned entities that makes all thedifference.

COMPONENT MIDDLEWARE

QoS Management, Monitoring and Adaptation

QoS EnabledApplication Server

Inter-Org.InteractionRegulation

QoS Monitoring andViolation Detection

APPLICATIONS

TAPAS ArchitectureThree main subsystems have been identified:

(i) The QoS management, monitoring and adaptation layer is intended to make the underlyingapplication server QoS enabled. It is responsible for reserving the underlying resourcesnecessary to meet the QoS requirements of applications hosted by that application server, andmonitoring the reserved resources, and possibly adapting resource usage (e.g., reserving somemore) in case the QoS delivered by these resources deviates from that required by theapplications.

10

(ii) All cross-organisational interactions performed by applications are policed by the Inter-Organisation Interaction regulation subsystem. We have developed techniques that enablerelevant aspects of contracts to be converted into electronic contracts (x-contracts) andrepresented using state machines and role based access control (RBAC) mechanisms for runtime monitoring and policing. This contract management system needs trusted coordinationservices providing non-repudiable service invocation (NR-Invocation) and non-repudiableinformation sharing (NR-Sharing) facilities.

(iii) It is necessary to ensure that a hosted application actually meets the QoS requirements (e.g.,availability, performance) stated in the hosting contract SLAs. For this reason, we need anapplication level QoS monitoring service, which must also measure various application levelQoS parameters, calculate QoS levels and report any violations. That is the function of the thirdsubsystem shown in the figure.

We can see that QoS monitoring is occurring at two distinct levels: within an application serverfor controlling use of application server resources and at higher level for controlling applicationlevel QoS requirements.

Second year work has been concerned with the development software for the above subsystems.

4.2. Overview of progress made in each workpackagesThe work within the TAPAS project has been structured into four technical workpackages:

• WP1 (Application Service Requirements and Specification) will meet the objectivesrelated to SLA specification, Service Composition and Analysis Techniques;

• WP2 (Design of QoS-aware Infrastructure for Application Hosting) and WP3(Implementation of QoS-aware Core Services) together will meet the objectives relatedto Trusted and QoS-aware Services for Application Hosting; and

• WP4 (Case Studies and Evaluation) will meet the objectives related to assessment.

All the second year deliverables have been produced, and their contents is summarised here.Note that there are no WP2 related activities in the second year, as the main focus of the work ison WP3, concerned with implementation.

D3: Method for Services Composition and Analysis (WP1)

QoS requirements of hosted applications as stated in SLAs are specified using SLAng.1Deliverable D3 presents our method for service composition and analysis. The method relies on2integrating analysis methods, representations of QoS aware systems, and service level3agreements in UML design tools. This locates all of the information required to reason about4service composition and analysis in a single repository. The reasoning itself is supported by5model transformations between design and analysis models, still within the same repository,6enabling a powerful and flexible approach to analysis.7

Our method relies on extending UML with a variety of domain specific languages each8appropriate to a modelling task, for example performance analysis or the representation of9SLAs. Each language is defined separately, but the common basis in UML permits the10integration of all of these models into a coherent view of the system.11

11

Each language has semantic information associated with it. SLAng, the profile for electronicservice systems, and the real-time profile used as the starting point for analysis all have richsemantic models. Other languages such as the profile for queuing networks have a definitionbased in mathematical formalisms. We also define relationships between our languageextensions. The mappings introduced relate analysis models to design domains. Thecorrespondence stereotype introduced allows the association of QoS information of differenttypes.

D8: QoS Enabled Group Communication (WP3)

Practical networked systems are under increasing obligations to provide certain levels of Qualityof Service (QoS) to end users. We here introduce a generic system model called theprobabilistic asynchronous model which we claim characterises the context in which manyInternet-based applications are built. Specifically, our model regards that basic services andsystem components (e.g., network services) do meet their performance requirements most of thetime, and occasionally they may not; only when they don’t, they adhere to the classicalasynchronous model. Our design approach will draw from, and combine probabilistic designtechniques and asynchronous ones. Its objective is to render systems that adaptively meet QoSobligations to the end users when system components meet their QoS guarantees or violatethem only marginally; eventual correctness is never compromised when components fail in theirQoS obligations.

Design and implantation of a QoS enabled reliable broadcast service using the principles of theprobabilistic asynchronous model is described. It is possible that the QoS guarantees agreed byunderlying network system are violated for a prolonged period. These violations can lead to thebroadcast service being unable to meet its QoS obligations. An important aspect of a QoSenabled service is that it needs to be adaptive: it monitors the QoS offered by the underlyinglayer and then adapts the protocol behaviour in an effort to meet the agreed QoS to users. TheQoS monitoring subsystem is thus an important part of the service. The QoS monitoringsubsystem of our reliable broadcast service has been designed using the principles described inthe deliverable report D10, on QoS Monitoring.

Note that in the TAPAS description of work document, deliverable D8 is referred to as‘Container for Group Communication’, however, the name has been changed here to ‘QoSenabled Group Communication’ as it better reflects the scope of the work.

D9: Component Middleware for Trusted Coordination (WP3)

All cross-organisational interactions performed by applications are policed by the Inter-Organisation Interaction regulation subsystem. Each enterprise expects access to other’sservices. An operation on a service is allowed only if it is permitted by the rules of the contractand then only if it is invoked by a legitimate role player of a participating enterprise. Thus, acontract is a mechanism that is conceptually located in the middle of the interacting enterprisesto intercept all the contractual operations that the parties try to perform. Intercepted operationsare accepted or rejected in accordance with the contract clauses and role players’ authentication.Our approach is to represent service interactions as finite state machines and make use of role

12

based access control mechanisms for authenticated access. In the deliverable report D5, wedescribe how contract clauses can be converted into finite state machines (FSMs).

Inter-Organisation Interaction regulation subsystem has two main layers. The contractmonitoring and enforcement layer makes use of the services of the underlying layer thatprovides trusted coordination.

To regulate the interactions involved, a given action must be attributable to the party whoperformed the action and commitments made must be attributable to the committing party. Forexample, it should not be possible for a client to subsequently disavow the request and/orconsumption of a service. Similarly, it should not be possible for the service provider tosubsequently deny having delivered the service. If information is shared then the parties sharingthe information should be able to validate a proposed update, the update should be attributableto its proposer and the validation decisions with respect to the update attributable to the otherparties. That is, to regulate an interaction we require attribution, validation and audit of theactions of the parties involved. Non-repudiable attribution binds an action to the partyperforming the action. Validation determines the legality of an action with respect to interactionagreements. Audit ensures that evidence is available in case of dispute and to inform subsequentinteractions

This deliverable addresses these requirements by providing two building blocks for regulatedinteraction between organisations: non-repudiable service invocation (NR-Invocation) and non-repudiable information sharing (NR-Sharing). It builds upon our earlier work on B2BObjectsdescribed in D5. These building blocks have been implemented using the JBoss applicationserver.

Note that in the TAPAS description of work document, D9 was titled as ‘Container for TrustedCoordination’. The title of the deliverable has been changed slightly to ‘ComponentMiddleware for Trusted Coordination’ as it better describes the scope of the work done.

D10: QoS Monitoring of SLAs (WP3)

Monitoring of contractual Service Level Agreements (SLAs) between service providers andconsumers is concerned with the collection of statistical metrics about the performance of aservice to evaluate whether the service provider complies with the level of Quality of the Service(QoS) that the consumer expects. Such monitoring is frequently required to be carried out withthe help of third parties to ensure that the results are trusted both by the provider and consumer.Deliverable D10 discusses the fundamental issues that monitoring of contractual SLAsinvolves: SLA specification, separation of the computation and communication infrastructure ofthe service provider, service points of presence, metric collection approaches, measurementservice and evaluation and violation detection service. This Deliverable develops an architecture,and gives reasons why currently it is only practicable to offer guaranteed QoS to consumerssharing Internet service providers with the service provider. The QoS monitoring subsystem ofour reliable broadcast service (D8) has been designed using the principles described here. TheAuction demonstrator application planned for September 2004 (deliverable D15) willdemonstrate how contractual SLAs for auctions (specified in SLAng) can be monitored and anyviolations detected.

13

Note that in the TAPAS description of work document, D10 was referred to as ‘Container forQoS Monitoring’. The title has been changed to ‘QoS Monitoring of SLAs’ as it betterdescribes the scope of the work done.

D13: Second Year Evaluation and Assessment Report (WP4)

In this report we discuss the progress of the TAPAS project during the second project yearfrom April 2003 to March 2004. The second year was characterised by highly interdependentand hence interactive research and development activities. In order to reflect these relationshipswe choose to present the main decisions and results of the second TAPAS year by discussing atypical TAPAS application scenario and it’s technical implications. The scenario provides arealistic background for discussions as well as for the evaluations to come. Hence it is quiteimportant to choose an appropriate scenario from industrial-relevant experiences. The chosenbusiness scenario, electronic auctions, is discussed in section 2 of the document. Thediscussions about the technical solutions of TAPAS for providing trust and QoS in such ascenario are reflected in section 3, followed by a short outlook in section 4. It should be notedthat we explicitly do not refer to the different deliverable documents as references as we aim tosummarize the discussions as well as the resulting design decisions and coherent solutiondesign. The Auction demonstrator application planned for September 2004 (deliverable D15) isintended to demonstrate main results of TAPAS.

5. Adherence to Workplan

5.1. Statement of resource usage

Effort in Person months for reporting period 1/4/03 – 31/3/04.

14

5.2. Deliverable schedule updateNo changes to the third year schedule were made. The titles of three deliverable reports werechanged to better reflect their technical contents. D8 is entitled ‘QoS Enabled GroupCommunication’ rather than ‘Container for Group Communication’, D9 is entitled‘Component Middleware for Trusted Coordination’ rather than ‘Container fro TrustedCoordination’ and D10 is now called ‘QoS Monitoring of SLAs’ rather than ‘Container forQoS Monitoring’.

The work for the third year will be concerned with integrating the various subsystems developedin the second year. The following deliverables will be produced:

- D4: Service Composition and Analysis Tool

- D6: Revised Architectural Design Document

- D11: Revised Container Interface Specification

- D14: Third Year Evaluation and Assessment Report

- D15: QoS-Aware and trusted ASP for Auctions

- D18: Technological Implementation Plan

5.3. Modifications to Workplan

No modifications have been made.

15

6. Co-operation in project

WP1: Application Service Requirements and SpecificationAs was anticipated in the technical annex relatively little work was done over the reporting1period (1/10/03-31/03/04) in WP1. In response to evaluation feedback provided by adesso,2UCL produced a new release of the service level agreement language SLAng and published it at3http://www.cs.ucl.ac.uk/staff/j.skene/slang. Moreover, work has commenced in Task 1.4 on4generating a compiler for SLAng, that generates QoS monitors that can then be used in the5framework developed within Task 3.46

The aim of Workpackage 1 is to identify the requirements of trusted and qos aware applicationservice provision. This aim has been achieved within the first year of the project to a largeextent.

The project has met in a number of plenary meetings in Bologna in April 2002, Cambridge inSeptember 2002 and Dortmund in February 2003 to discuss requirements and an approach todefining quality of service at different levels of abstraction. In addition to these plenarymeetings, workshops between partners involved in WP2 were held at UCL (twice) and Bologna.

WP3: Implementation of QoS-aware Core Services

TAPAS partners held several meetings to carry out the work for the deliverables D8, 9 and 10.Cambridge and Newcastle jointly produced D10. Newcastle and Bologna worked on the designof the QoS enabled application server. Adesso activities were focused on giving support andfeedback to the other partners. The feedback was based on two aspects, which are in the domainof Adesso’s knowledge. Firstly Adesso could bring in its industrial knowledge about ASPscenarios into the discussions about inter-organizational regulation and QoSmonitoring. Thisleads to economically reasonable decisions about the design and implementation directions.Secondly adesso could utilize its proven knowledge in the field of J2EE software developmentby giving feedback for middleware design and new impulses to the implementation activities.These activities have not only taken part during the team workshops and the technical meetingsbut as well during the distributed design and development activities by using email and othermeans of communication.

Based on the experiences from many J2EE projects, in which Adesso successfully planned andimplemented clustered application server environments, the Adesso experts were able to providemeaningful hints and knowledge transfer to the implementation teams. Aside from the J2EEimplementation activities Adesso fed its ASP knowledge into the discussion about the SLAngitems. This lead to valuable feedback for the UCL team as well as for the Bologna team. However, the technical feedback and integration have been very valuable for the progress of theTAPAS activities. It should be mentioned that the social integration of the TAPAS team hasbeen stimulated by these discussions, which helped to increase the efficiency and to avoidmisunderstandings.

16

WP4: Evaluation and AssessmentOne major goal of the TAPAS project is to provide industrial relevant solutions. This isachieved on the one hand by the participation of Adesso as industrial partner and on the otherhand by discussions with the industrial advisory boards, let alone the proven industrialknowledge of the scientific team members. Hence Adesso is responsible for the evaluation ofthe results, achieved by evaluation reports on the one hand and by developing a dedicatedapplication on the other hand. The second year evaluation report is contained in deliverable D13,which reflects the application scenario discussions and the resulting technical design decisions. The choice of the scenario and hence the type of application for evaluation has been driven bythe need to reproduce QoS and trust problems by application use cases in order to evaluate theTAPAS solutions for QoS and trust. Auctions have been quickly identified to be a promisingfield for such issues, because auction users have a high demand for QoS and trust. In order todefine a sound scenario Adesso has been exploring the field of B2B auctions. This leads tocertain specifications for the application to be developed and has been incorporated in the visiondocument, which is part of D15. It must be noted that currently typically large enterprises suchas car manufacturers use auctions in the procurement processes to lower prices, while small andmedium enterprises mostly do not dare yet to invest into this type of service. Based on theobservations and discussions with TAPAS partners we were able to produce artefacts for thesubsequent software development activities such as a vision document, use cases, requirements,domain model, component and deployment diagrams. Due to the iterative nature of the UnifiedProcess, which we follow, these documents need refinement in subsequent steps. CurrentlyAdesso developers work on implementing a prototype, which is intended to highlight certainrisks that have been identified. For instance the usage of a component to provide time-basedactivation of e.g. auction rounds will leave the concept of J2EE application servers, which leadsto many problems with clustering and reliability. In addition Adesso has started to derive testcases and a demonstration scenario from the use cases and the vision in preparation of theevaluation activities.

WP5: Dissemination and ImplementationWerner Beckmann has been interviewed by “Computerwoche” regarding outsourcing andservice management. This resulted in an article covering the recent outsourcing trends. Furthermore we are currently preparing sales prospects and presentations to address existingand new clients regarding QoS-assurance and supervision. A number of research publicationshave been produced and presented at international conferences (see section 8).

WP6: Project ManagementIn this workpackage the management activities included attendance at IAB (2n d February, 2004)and EB meetings (29th Sept.03 and 20th February, 04) as well as the preparation of technicalmeetings.

Also during this period there was a change of personnel at the University of Cambridge. DrPanos Gevros left to join a bank working on using similar ideas to TAPAS, but instead ofnetwork provisioning and performance guarantees, investment portfolio prediction!

Dr Michael Dales joined the University of Cambridge fairly soon after, and took upimmediately work on monitoring collaborating with Newcastle, and attended the last projectmeeting in Bologna.

17

7. Co-ordination with other projects/programmesCooperation has been established with the following both EU funded and nationally fundedprojects.

UCL: SEGRAVIS RTN (Collaboration between TU Berlin, Milan Bicocca and UCL) started1first results presented at 4th ACM Workshop on Software Performance. European Grid for2Solar Observations (EGSO), joint work on web services orchestration.3

Cambridge: Jon Crowcroft met with Ulrich Lang from the EU COACH project, and talkedabout trusted SLAs - a further meeting is foreseen.

Bologna: RTD Projects funded by the Information Society Technologies Programme of theEuropean Commission: ADAPT (Middleware Technologies for Adaptive and ComposableDistributed Components), IST-2001-37126; Nationally funded projects:

• "Information Society - Architectures and Protocols for Replicated Web Services", fundedby the Italian Ministry of the Education, University, and Research (MIUR);

• "Design, development, and evaluation of an infrastructure for supporting mobile, multimodalaccess to Web services", funded by the Emilia-Romagna County Council;

• FIRB "WebMinds" project funded by the Italian Ministry of Education, University andResearch.

Newcastle: Newcastle, Bologna and Arjuna Technologies are taking part in EU Project IST-2001-37126: “ADAPT (Middleware Technologies for Adaptive and Composable DistributedComponents” where there is specific collaboration of trust and security. Newcastle is alsotaking part in two UK funded projects on virtual organisations that complement the work beingdone in TAPAS. In particular, in the GOLD project, Web services and component middlewarewill be used as the enabling technology to develop a set of methods and tools for dealing withtrust, security, lifecycle and information management in highly dynamic Virtual Organisations(VOs) the chemical industry.

18

8. Promotion / Information Dissemination

8.1. Conferences and WorkshopsTAPAS project members attended the following conferences during the first year of the project:

14th Database and Expert Systems Applications (DEXA'03) attended by Nicola Mezzetti.

Test and Analysis of Component Based Systems, 13th April, overall European JointConferences on Theory and Practice of Software (ETAPS) in Warsaw 5 – 13 April ’03attended by J Skene.

Future Trends of Distributed Computing Systems (FTDCS) May 28 30, 2003, Puerto Ricoattended by D. Lamanna

IEEE International Conference on Electronic Commerce, Newport Beach, CA, June 2003,attended by Carlos Molina

4th IEEE International Workshop on Policies for Distributed Systems and Networks, Lake ofComo, 4-6 June 2003 attended by A di Ferdinando

Middleware 2003 16-20 June 2003, Brazil attended by D Lamanna

7th International Conference on Internet, Multimedia Systems and Applications (IMSA 2003),Honolulu, (HI), August 2003.

Workshop on Revisiting IP QoS: Why do we care, what have we learned? (RIPQOS)Karlsruhe, Germany, August 27, 2003 attended by Jon Crowcroft and Panos Gevros

Seventeenth Annual IFIP WG 11.3 Working Conference on Data and Applications Security,Estes Park, Colorado, August 2003, attended by Santosh Shrivastava

IEEE International Conference on Information Technology: Research and Education (ITRE2003), Newark (NJ), August 2003

Bertinoro Summer School on Formal Methods for Software, Bertinoro, Italy, 22-24 September,2003 attended by W. Emmerich

Bertinoro International Spring School for Graduate Studies in Computer Science, 8-19 March2004, attended by Santosh Shrivastava (presented a course on middleware)

14th DEXA Workshops 2003, Prague, Czech Republic, 1-5 Sept. 2003.

Workshop on Service Based Software Engineering in Pisa (FM2003-SBSE), 8th Septemberwith FME, Pisa, 8 – 14 Sept. 03 attended by J Skene

8th CaberNet Radicals Workshop, Ajaccio, Corsica, 5-8 October 2003.

5th CaberNet Plenary Workshop, 5-7 November 2003, Porto Santo, Portugal

19

3rd International Conference on Networking (ICN'04), February 29 - March 4, 2004: CreoleBeach Hotel, Gosier, Guadeloupe, French Caribbean.

8.2. PublicationsAmoroso, A. and Panzieri, F., "A scalable architecture for responsive auction services over theInternet", TR UBLCS-2003-09, Dept. of Computer Science, University of Bologna, June 2003.

Cook, N., Shrivastava, S. and Wheater, S. “Middleware Support for Non-repudiableTransactional Information Sharing between Enterprises”, 4th IFIP International Conf. onDistributed Applications and Interoperable Systems, DAIS 03, November 2003, Paris

Nick Cook, Paul Robinson and Santosh Shrivastava, “Component Middleware to SupportNon-repudiable Service Interactions”, DSN 04, Florence, June 2004.

Crowcroft, J., Hand, S. Mortier, R., Roscoe, T., Warfield, A "QoS`s Downfall: At the bottom, ornot at all!" In Proceedings of the ACM Workshop on Revisitng IP Quality of Service(RIPQoS), pp. 109-114, August 2003, Karlsruhe, Germany.

Denaro, G., Polini, A. and Emmerich, W.”Early Performance Testing of Distributed Software1Applications”, in Proceedings of the 4th Int. Workshop on Software and Performance, San2Francisco, January 2004 (ACM Press)3

Di Ferdinando, A., McKee, P. and Amoroso, A.: A Policy Based Approach for AutomatedTopology Management of Peer To Peer Networks and a Prototype Implementation

Ezhilchelvan, P.D. and Shrivastava, S.K. “Systematic Development of a Family of FairExchange Protocols”, Seventeenth Annual IFIP WG 11.3 Working Conference on Data andApplications Security, Estes Park, Colorado, August 2003.

Ferretti, S., Roccetti, M.``On Designing an Event Delivery Service for Multiplayer NetworkedGames: An Approach based on Obsolescence'', Proc. 7th International Conference on Internet,Multimedia Systems and Applications (IMSA 2003), Honolulu, (HI), August 2003.

Gevros, P. "Internet Service Differentiation using Transport Options: the case for policy-aware congestion control" In Proceedings of the ACM Workshop on Revisitng IP Quality ofService (RIPQoS), pp. 151-157, August 2003, Karlsruhe, Germany.

Kaveh, N and Emmerich, W. Validating Distributed Object and Component Designs in FormalMethods for Software Architecture, Springer Verlag, Lecture Notes in Computer Science, vol.2804, 2003, pages 63-91, Edited by M. Bernardo and P. Inverardi KE03: Validating)

Kistijantoro, A.I., Morgan, G, Shrivastava, S.K. and Little, M.C. “Component Replication inDistributed Systems: a Case study using Enterprise Java Beans”, 22n d IEEE/IFIP Symposiumon Reliable Distrinbuted Systems (SRDS2003), Florence, October 2003, pp. 89-98, ISBN: 0-7695-1955-5.

20

Lamanna, D.D., Skene, J and Emmerich, W SLAng: A Language for Service Level AgreementsIn Proceedings of the 9th IEEE Workshop on Future Trends in Distributed ComputingSystems (LSE03: SLAng), 2003, (pages 100-106) IEEE Computer Society Press

Lodi, G. and Panzieri, F. "JBoss vs. JOnAS", TAPAS Project Internal Report, June 2003.

Mezzetti, N.: "Towards a Model for Trust Relationships in Virtual Enterprises" InProceedings of 14th Database and Expert Systems Applications (DEXA'03) Workshop, 1 - 5September 2003, Prague (Czech Republic).

Molina-Jimenez, C., Shrivastava, S.K., Solaiman, E. and Warne, J. “Contract Representationfor Run-time Monitoring and Enforcement”, IEEE Conference on Electronic Commerce(CEC’03), Newport Beach, CA, June 2003, pp. 103-110.

C. Molina-Jimenez, S.K. Shrivastava, E. Solaiman and J. Warne, “Run-time Monitoring andEnforcement of Electronic Contracts”, Electronic Commerce Research and Applications(ECRA), Elsevier, Vol. 3, No. 2, 2004.

Carlos Molina-Jimenez, Santosh Shrivastava, Jon Crowcroft and Panos Gevros, “On theMonitoring of Contractual Service Level Agreements”, The First IEEE International Workshopon Electronic Contracting (WEC), July 2004, San Diego.

Roccetti, M., Salomoni, P. ``The Design and Performance of a Wireless Internet Application forSupporting Multimedia City Guides'', Proc. IEEE International Conference on InformationTechnology: Research and Education (ITRE 2003), Newark (NJ), August 2003.

Rodrigues G N, Roberts, G, Emmerich, W and Skene, J Reliability Support for the ModelDriven Architecture In Proceedings of the ICSE Workshop on Software Architecture forDependable Systems 2003 (RRES03: Reliability Support), ICSE 2003.

Skene, J. and Emmerich, W. Model Driven Performance Analysis of Enterprise InformationSystems in Electronic Notes in Theoretical Computer Science, April 2003, vol. 82, number 6(SE03: Performance)

Skene, J and Emmerich, W A Model Driven Architecture Approach to Analysis of Non-Functional Properties of Software Architectures In Proceedings of the 18th IEEE Conferenceon Automated Software Engineering (SE03: AModel), October 2003, Montreal, Canada (pages236-239), 2003. IEEE Computer Society Press

Skene, J., Piccinelli, G. and Stearns, M Modelling Electronic Service Systems Using UML inWorkshop on Service Based Software Engineering, FM2003-SBSE, Pisa, Italy, 2003,September, "Technische Universi taet Muenchen", pages15—30, url:http://www.cs.ucl.ac.uk/staff/J.Skene/phd/sbse2.pdf (SPS03: Modelling)

J. Skene, D. Lamanna and W. Emmerich. Precise Service Level Agreements. In Proc. of the26th Int. Conference on Software Engineering, Edinburgh, UK, Sept. 2004. ACM Press.

21

Solaiman, E., Molina-Jimenez, C. and Shrivastava, S.K. “Model Checking CorrectnessProperties of Electronic Contracts”, International Conference on Service Oriented Computing,Trento, November, 2003

Turrini, E. “Dependability Issues in Content Distribution Internet-working”, in Proc. of theInternational Conference on Dependable Systems and Networks, Student Forum, June 2003

Turrini, E, Ghini, V. “A Protocol for exchanging performance data in Content DistributionInternetworks”, 3rd International Conference on Networking (ICN'04), February 29 - March 4,2004 – Creole Beach Hotel, Gosier, Guadeloupe, French Caribbean

Turrini, E.,“A Protocol for exchanging performance data in Content DistributionInternetworks”, 8th CaberNet Radicals Workshop, Ajaccio, Corsica, 5 - 8 October 2003.

Turrini, E.“An architecture for Content Delivery Networks federation”, CaberNet PlenaryWorkshop, 5-7 November 2003, Porto Santo, Portugal.

Turrini, E. “Analyzing web response time” , CaberNet Plenary Workshop, 5-7 November2003, Porto Santo, Portugal.

“Die zweite ASP-Welle ist auf dem Weg“ (The second wave of ASP is on it’s way) in“Computerwoche“, pp 34-35, IDG Business Verlag GmbH, 26/2003, München, Germany

“TAPAS macht Appetit auf ASP” (TAPAS whets one’s appetite for ASP), eCommerceMagazin 06-07 /2003, IWT Magazin Verlags-GmbH, Vaterstetten, Germany

“An Answer to the JBoss vs. JOnAS Comparison”, W. Beckmann, M. Koßmann, adesso AG,30 June 2003

8.3. Press Articles

Memos: “An Answer to the JBoss vs. JOnAS Comparison”, W. Beckmann, M. Koßmann,Adesso AG, 30 June 2003

8.4. Activities related to standardisationUCL: Monitoring developments on MDA at OMG. Contribution to MDA discussion.1

Jon Crowcroft attended the IETF in Seoul, Korea, and contributed in working groups for group2communication.3

8.5. Industrial Advisory Board MeetingsThe members of the IAB were invited to meet with the TAPAS Executive Board at the TAPASEB/IAB Meeting, held in London on 2n d February, 2004. Three members of the IAB attended:Prof. Dr. Rudolf Keller (Zühlke Engeneering), Dr. Stuart Wheater (Arjuna Technologies), PaulMcKee (BT exact Technologies).

This section summarises the remarks made by these IAB members with regard to the progressof TAPAS by February 2003, as evidenced by the presentations. The following presentationswere made:

22

1. Overview, Santosh Shrivastava, Ncl

2. Service Level Agreement Language, James Skene, UCL

3. QoS Management, Monitoring and Adaptation, Fabio Panzieri, Bologna

4. QoS Monitoring and Violation Detection, Carlos Molina, Ncl

5. Evaluation approach for TAPAS, Werner Beckmann, Adesso

6. ‘Under the bonnet’, Jon Crowcroft, Cambridge

Much of the discussion centred on the talks made by Bologna (QoS Management, Monitoringand Adaptation) and Newcastle (QoS Monitoring and Violation Detection).

QoS Management, Monitoring and Adaptation:

Bologna is about to set up an experiment on clustering across all sites - we are keen to knowfrom IAB members if they thought this was a good idea. In general there was acknowledgmentthat it would be and that the results would be interesting. Paul McKee thought that this is agood idea in terms of providing QoS over wide area clusters. Paul McKee enquired why we areusing JBoss, when earlier analysis made positive comments on JoNas. Fabio Panzieri statedthat use of interceptors in JBoss enables easy accommodation of monitoring and trust relatedenhancements; further, currently, JBoss has better load balancing and clustering facilities.

QoS Monitoring and Violation Detection:

This talk raised an interesting point concerning violation detection between parties involved (ISPand service consumer) that will require the project team to think through the ‘monitoring’ inmore detail. Shrivastava asked what industry (BT) does now. Paul McKee replied if thecustomer pays enough then all eventualities are covered including monitoring of the ‘serviceconsumer’. On the whole need different strategies for different problems.

Rudolf Keller said that having missed the last meeting (April ’03), he is impressed at howmuch progress has been made. He can see that the implementation stage will be mostinteresting and is curious to learn the results in due course. Paul McKee Agreed that the projectwas at an interesting stage and looked forward to the results of the geographical clusteringexperiment from Bologna. Would be a nice QoS feature if successful.

23

9. General Comments

The first year activities already have utilized recent developments and research topics such asModel Driven Architecture (MDA), which has been incorporated into the Model DrivenPerformance Analysis (MDPA) research.

Adesso remarked that especially in Germany, there is an economic downturn, that leads toreinforced outsourcing activities. This is reflected in various articles on ASP in the Germanpress.

Since TAPAS started, a Web Services have arrived on the scene and are rapidly being adoptedin industry. In order to ensure validity of the TAPAS results, Web Services have beenincorporated into the Service Level Agreement Formalism defined at UCL. The TAPASarchitecture is well suited to the Web services world as J2EE component middleware and Webservices are closely linked.

10. ConclusionThe project has produced all the deliverables on time and is running on schedule.